Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    01-06-2024 04:05

General

  • Target

    2024-06-01_fd133ca2be3d23cb0eafe64682007aa6_cryptolocker.exe

  • Size

    43KB

  • MD5

    fd133ca2be3d23cb0eafe64682007aa6

  • SHA1

    39735a2064529a0ed19a8430418ef7510454c4cb

  • SHA256

    dccb07c155579c24ccb505a00e566295022b29cb343bd58b9acb18a62f5c2806

  • SHA512

    411d7497c35697cef036494c4fe4c6658ff736df532c26be25cb64914b05eaf7f20e93b8cd1457a3569385f3035d1516eef4aa68670528057901a1aeaf6f9ba6

  • SSDEEP

    768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/CtXabM0t:6j+1NMOtEvwDpjrR2XabMq

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Detects executables built or packed with MPress PE compressor 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-01_fd133ca2be3d23cb0eafe64682007aa6_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-01_fd133ca2be3d23cb0eafe64682007aa6_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:1748

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    44KB

    MD5

    cda1fd6c6b13b69704dd73d54593607a

    SHA1

    70ae5fbabf10073b3f6f49260072a635e88e9cba

    SHA256

    b58db78812d43a81047d5397c820c5772866dbfcdbd724a05123e284f778887b

    SHA512

    3bc4178371ec53462b481b54914414751e70d8f0eee837473a54b739a41be5188bbe37a056c9ac0cf7d0a97d3e01c7889acbaf92ce8ba9863cc6f2dc20507bc4

  • memory/1748-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/1748-18-0x0000000000460000-0x0000000000466000-memory.dmp

    Filesize

    24KB

  • memory/1748-25-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/1748-26-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2220-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2220-1-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2220-3-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB

  • memory/2220-9-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2220-15-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB